CVE-2019-12524

NameCVE-2019-12524
DescriptionAn issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4682-1
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster4.6-1+deb10u1vulnerable
buster (security)4.6-1+deb10u2fixed
bullseye4.11-2fixed
sid4.11-5fixed
squid3 (PTS)jessie3.4.8-6+deb8u5vulnerable
jessie (security)3.4.8-6+deb8u9vulnerable
stretch (security), stretch3.5.23-5+deb9u1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)4.8-1
squidsourcebuster4.6-1+deb10u2DSA-4682-1
squid3source(unstable)(unfixed)

Notes

http://www.squid-cache.org/Advisories/SQUID-2019_4.txt
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2019_4.patch

Search for package or bug name: Reporting problems